I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment.
A simple deterministic commitment scheme Commit(x) = Hash (x) may be insecure, since I read some time ago that this attack is possible:
Given y = hash(x) , the attacker finds z so that z = hash(f(x)). Here f() might be the addition of a suffix to the message or any other mathematical transformation.
None of the three properties of hash functions (pre-image resistance, second pre-image resistance and collision resistance) prevents this attack to be feasible.
I find keyed MACs (Message Authentication Codes) more suited for commitments. Setting Commit(x) = MAC(k,x) and opening the commitment by publishing k and x seems to prevent the attack, but I found no literature on this topic.
I also found Something called perfectly one-way hash function (POWHF), but I found no simple practical example of such a construction.